Hybrid CNN-LSTM for Cyberattack Classification in Sudanese E-Government SDN

In the modern world, governments are increasingly moving their operations online, creating digital portals where citizens can access services, pay taxes, and retrieve records without visiting a physical office. This shift, known as e-government, relies heavily on complex computer networks to connect these services to the people who need them. To make these networks faster and easier to manage, many are adopting a new architecture called software-defined networking. This approach separates the brain of the network, which makes decisions about where data goes, from the muscle, which actually moves the data. While this makes the system more flexible, it also creates a new kind of vulnerability: if an attacker can trick the central brain, they can disrupt the entire system. Furthermore, as these digital platforms grow, they become targets for sophisticated cyberattacks that try to steal data or shut down services. Traditional security systems, which rely on looking for known bad patterns like a librarian checking a list of banned books, often struggle to catch new, evolving tricks or the sheer volume of encrypted traffic. This leaves a critical gap in protecting the sensitive information of millions of citizens.

To address this challenge, researchers in Sudan have developed a new, intelligent system designed to spot these cyberattacks before they cause harm. The team, led by Rania ElshiekhHamid from the Sudan University of Science and Technology, recognized that the country's specific digital landscape required a custom solution. They knew that standard security tools were not enough to handle the unique mix of web traffic and network flows found in Sudan's government portals. Instead of relying on old methods, they built a hybrid deep learning model. This system combines two powerful types of artificial intelligence: one that is excellent at spotting patterns in raw data, like a camera recognizing shapes, and another that is skilled at understanding sequences and timing, like a reader following the flow of a story. By merging these two approaches, the system can look at both the immediate content of a data packet and the history of how that data arrived, allowing it to distinguish between a legitimate citizen request and a malicious attack with high precision.

The biggest hurdle the researchers faced was a lack of real-world data. Because of strict privacy laws and national security concerns, they could not simply use real logs from the government's servers to train their system. To solve this, they created a custom dataset that mimicked the real environment without exposing any private information. They combined three different sources of information to build this training ground. First, they used global benchmarks that contain examples of common network attacks, such as denial-of-service attempts that flood a system with traffic. Second, they included datasets specifically designed to show web-based attacks, like attempts to inject harmful code into a website. Finally, to make the simulation truly local, they used a computer program to generate artificial traffic that behaved exactly like the Sudanese government's network, including the specific delays and routing patterns found in their infrastructure. This synthetic data allowed them to train their model on a realistic representation of the threats facing Sudan, ensuring the system would work when deployed.

Once the model was trained, the researchers put it to the test to see how well it could identify attacks compared to older methods. They compared their new hybrid system against several established techniques, including traditional machine learning tools that rely on human experts to define what an attack looks like, and other standalone artificial intelligence models. The results were clear. The new hybrid model achieved an overall accuracy of 97.8 percent, meaning it correctly identified the nature of the traffic in nearly every single case. More importantly, it kept the rate of false alarms incredibly low, flagging fewer than 1.5 percent of legitimate requests as dangerous. In the context of government services, a false alarm is a serious problem because it can block a citizen from accessing their own data or paying a bill. By keeping this number so low, the system ensures that services remain available to the public while still catching the bad actors.

The study also looked at how fast the system could make these decisions. In a network that handles thousands of requests per second, a security system cannot be slow, or it will become a bottleneck that delays everything. The researchers found that their model could analyze a single piece of data and make a prediction in just 18.6 milliseconds. This speed is fast enough to fit within the real-time requirements of the network controller, meaning it can stop an attack the moment it happens without slowing down the flow of information. The system proved particularly effective against specific types of threats, correctly identifying SQL injection attempts, which try to manipulate databases, and distributed denial-of-service attacks, which try to overwhelm a server, with success rates exceeding 98 percent. These findings suggest that the hybrid approach is not just theoretically sound but practically viable for protecting critical national infrastructure.

While the results are promising, the researchers are careful to note that this is a step forward, not a final solution. The model was tested on a dataset that, while highly realistic, was generated to simulate the environment rather than pulled from live, ongoing government traffic. The team acknowledges that as cyberattacks continue to evolve, the system will need to adapt. In their future work, they plan to explore a method called federated learning. This approach would allow different government agencies to train the security model together using their own local data without ever having to share the raw, sensitive information with a central server. This would further strengthen the system's ability to detect new threats while respecting the strict privacy and security constraints that govern the handling of citizen data. For now, however, the study provides a strong foundation for a more secure digital future, offering a scalable, intelligent baseline that can help protect the integrity and trust of Sudan's e-government services.